Request signing

HMAC-SHA256 over a canonical string. Required for API-key message routes.

Signature string

text

METHOD\nPATH\nTIMESTAMP\nNONCE\nBODY_JSON\n

PATH: /messages/sms (no /api/v1 prefix)
BODY_JSON: recursively sorted keys, compact JSON
Timestamp within ±5 minutes of server time
Nonce: unique per request (replay blocked)
Non-browser User-Agent required

Node.js example

javascript

const crypto = require('crypto');

function sortKeys(obj) {
  if (!obj || typeof obj !== 'object' || Array.isArray(obj)) return obj;
  return Object.keys(obj).sort().reduce((acc, k) => {
    acc[k] = sortKeys(obj[k]);
    return acc;
  }, {});
}

function sign(method, path, ts, nonce, body, apiKey) {
  const bodyStr = JSON.stringify(sortKeys(body));
  const s = `${method}\n${path}\n${ts}\n${nonce}\n${bodyStr}\n`;
  return crypto.createHmac('sha256', apiKey).update(s).digest('hex');
}